Threats affecting pkg:npm/aandrew-me/ytdownloader

CVE-2026-6219 is a command injection vulnerability in aandrew-me ytDownloader versions up to 3.20.2. It affects the child_process.exec function in the src/compressor.js file within the Compressor Feature component. The vulnerability allows an attacker with local access to execute arbitrary commands. The exploit has been publicly disclosed, but there are no confirmed reports of exploitation in the wild. No official patch or remediation guidance has been provided by the vendor at this time.